agenttesla

General

Target
OKWZcZcmCvIE09W.exe
Size 875KB
Sample220217-htsvqsada4
SHA256 31a3c2f298b8b235303ecdcbe989f24ddda02a2da072c78cb0c6d0f8e9cd282a
MD5 e9229ff99b468546cbc0f850933a01a5
SHA1 d891329d0e3e669fc24c1cb9876c20e4a031d159
SHA512 d07d7fa9eaa846c022c42dd8154794831528d6dc7fad383e35d96d80d07857191639fabd058e90dff2e872943ad83bb344cbd8dfbed3264a14c4bff55be5c732
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.pas-shipping.com
Port
587
Username
[email protected]
Password
Chik@kerdiamoo1400
Email to
[email protected]

Targets

- Target
  OKWZcZcmCvIE09W.exe
- Size 875KB
- SHA256 31a3c2f298b8b235303ecdcbe989f24ddda02a2da072c78cb0c6d0f8e9cd282a
- MD5 e9229ff99b468546cbc0f850933a01a5
- SHA1 d891329d0e3e669fc24c1cb9876c20e4a031d159
- SHA512 d07d7fa9eaa846c022c42dd8154794831528d6dc7fad383e35d96d80d07857191639fabd058e90dff2e872943ad83bb344cbd8dfbed3264a14c4bff55be5c732
- MD5 SHA1 SHA512
Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- AgentTesla Payload
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

AgentTesla Payload

Drops file in Drivers directory

Accesses Microsoft Outlook profiles

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2